CVE-2026-78192

The record

WebDyne versions from 2.022 before 3.022 for Perl disclose application source to unauthenticated clients via the viewer in the default index page. WebDyne's wrapper scripts, such as webdyne.psgi, enable the built-in index page by default. Its source viewer returns files under the document root named in the source parameter of an HTMX request, including .psp, .pm and .pl files. A remote attacker can read the application's Perl code, including the __PERL__ blocks of .psp pages and any credentials they hold.

Affected packages

Related vulnerabilities

• CVE-2026-84390 A inclusion of sensitive information in source code vulnerability in Fortinet… CWE-540
• CVE-2026-16581 In igloohome Smart Lock Mobile App versions 3.2.3 and prior, an Inclusion of Sensitive… CWE-540
• CVE-2026-45728 Algernon is a small self-contained pure-Go web server. CWE-540
• CVE-2026-4155 ChargePoint Home Flex Inclusion of Sensitive Information in Source Code Information… CWE-540
• CVE-2026-35383 Bentley Systems iTwin Platform exposed a Cesium ion access token in the source of some… CWE-540
• CVE-2026-22275 Dell ECS, versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to… CWE-540
• CVE-2026-95860 node-opcua is an OPC UA implementation for TypeScript and Node.js. CWE-1188
• CVE-2026-120091 Temporal Server compiles a Worker Controller Instance module… CWE-1188